Millions of Americans are inadvertently sending their internet traffic to Chinese companies—including several tied to the People’s Liberation Army. Millions of Americans have downloaded apps that secretly route their internet traffic through Chinese companies, according to an investigation by the Tech Transparency Project (TTP), including several that were recently owned by a sanctioned firm with links to China’s military.

TTP’s investigation found that one in five of the top 100 free virtual private networks in the U.S. App Store during 2024 were surreptitiously owned by Chinese companies, which are obliged to hand over their users’ browsing data to the Chinese government under the country’s national security laws. Several of the apps traced back to Qihoo 360, a firm declared by the Defense Department to be a “Chinese Military Company." Qihoo did not respond to questions about its app-related holdings.

VPNs allow users to mask the IP address that can identify them, and, in theory, keep their internet browsing private. For that reason, they have been used by people around the world to sidestep government censorship or surveillance, or because they believe it will improve their online security. In the U.S., kids often download free VPNs to play games or access social media during school hours.

However, VPNs can themselves pose serious risks because the companies that provide them can read all the internet traffic routed through them. That risk is compounded in the case of Chinese apps, given China’s strict laws that can force companies in that country to secretly share access to their users’ data with the government.

It would be hard for U.S. users to avoid the Chinese VPNs. The ownership of many appeared deliberately opaque, with several concealing their structure behind layers of offshore shell companies. TTP was able to determine the Chinese ownership of the 20 VPN apps being offered to Apple’s U.S. users by piecing together corporate documents from around the world. None of those apps clearly disclosed their Chinese ownership.

The VPN apps identified by TTP have been downloaded more than 70 million times from U.S. app stores, according to data from AppMagic, a mobile apps market intelligence firm.

One Chinese VPN has been advertised on Facebook and Instagram to teens as young as 13, and some have targeted ads at Americans looking to keep using TikTok, another Chinese app threatened with a U.S. ban. U.S. lawmakers said they acted on TikTok over concerns it could collect data from its American users on behalf of the Chinese government. However, lawmakers have not given sustained attention to this wider category of VPN apps that could make Americans’ internet traffic available to Chinese authorities.

The findings raise questions about Apple’s carefully cultivated reputation for protecting user privacy. The company has repeatedly sought to fend off antitrust legislation designed to loosen its control of the App Store by arguing such efforts could compromise user privacy and security. But TTP’s investigation suggests that Apple is not taking adequate steps to determine who owns the apps it offers its users and what they do with the data they collect. More than a dozen of the Chinese VPNs were also available in Apple’s App Store in France in late February, showing that the issue extends to other Western markets.

Apple’s guidelines for app developers state that apps offering VPN services “may not sell, use, or disclose to third parties any data for any purpose.” It isn’t clear how Apple reconciles that policy with the presence of Chinese VPN apps in its App Store, given those apps can be required by law to turn over user data to Chinese authorities.

Apple and most of the app developers mentioned in this report did not respond to requests for comment. Emails sent to two of the apps, Thunder VPN and Snap VPN, bounced back as undeliverable, and another app, Speedy Quark VPN, provided an online contact form which was not functional.

Background and methodology China has enacted a series of national security laws over the last decade outlining its access to data held by Chinese companies. Chief among these is the country’s National Intelligence Law of 2017, which requires that China-based organizations and individuals cooperate with state intelligence work. According to guidance from the U.S. Department of Homeland Security, in practice, this means that Chinese intelligence agencies may demand access to data of U.S. individuals and businesses held by Chinese entities and even compel the creation of backdoors in equipment and software.

The guidance also specifically references apps, stating, “Data collected through software and mobile applications owned or operated by PRC firms is also accessible to the PRC government through its legal system.”

Citing the risks of China collecting data on U.S. users, Congress last year passed legislation forcing a sale or ban of TikTok, though President Trump has temporarily suspended enforcement of the law to give more time to find a potential buyer, and Apple and Google have restored TikTok to their app stores after briefly removing them.

In addition to the TikTok ban, the U.S. in 2020 forced Chinese gaming company Beijing Kunlun Tech to sell off U.S.-based Grindr, the LGBTQ dating app, amid concerns that the user data collected by the app, including HIV status, could be leveraged to blackmail American officials or military personnel.

The U.S. has also banned approvals of new telecommunications equipment from Huawei and other Chinese companies and authorized funds to help small and rural U.S. phone networks remove and replace Chinese-made telecom gear, which U.S. officials say provides an opportunity for spying on Americans.

A handful of U.S. lawmakers—including Sens. Mark Warner (D-VA), Ron Wyden (D-OR), and Marco Rubio (R-FL), who is now secretary of state—have raised alarm in recent years that foreign VPN apps, particularly those controlled by China or Russia, could be used to surveil U.S. government employees and spy on Americans. But the issue has not yet attracted major public attention or broader interest in Congress.

To test the availability of Chinese VPN apps in the Apple App Store, TTP started with a list of the top 100 most downloaded free VPN apps for iPhone and iPad in 2024 in the U.S., as ranked by AppMagic, a mobile apps market service. AppMagic estimates download data and app revenue based on public databases and information submitted by app developers who use its platform. (Apple does not provide exact download statistics for the App Store.)

App pages in the Apple App Store are required to provide the name of the developer and a link to the app’s privacy policy. For each of the free VPN apps in the dataset, TTP sought to identify the app developer’s location via information on the App Store page, the app’s privacy policy page, and any other external websites associated with the app. The research at times involved tracking ownership via layers of shell companies. If the app’s developer was based in Singapore, the Cayman Islands, Hong Kong, or mainland China, TTP examined corporate records where available.

Ultimately, TTP determined that 20 of the top 100 free VPN apps in the App Store were owned by companies or individuals based in mainland China or Hong Kong but did not clearly disclose their China ties. (Companies registered in Hong Kong are subject to that region’s own, separate national security laws, though most of the Hong Kong companies identified by TTP appeared to be shell companies operated by owners in mainland China.)

TTP excluded apps from its count that clearly labelled themselves as Chinese in the App Store, making their China connection clear to users.

Link to U.S.-sanctioned company TTP started with an app called Turbo VPN, which ranked 13th in the top 100 free VPN offerings in the Apple App Store last year. The app’s developer is listed as Innovative Connecting Pte. Ltd. (This company is also the developer of a free VPN app called Signal Secure VPN that is not in the top 100.)

Innovative Connecting Pte. Ltd is registered in Singapore, and corporate records there indicate its sole shareholder is an entity called Lemon Seed Technology Ltd. in the Cayman Islands.

A major Chinese cybersecurity company called 360 Security Technology, also known as Qihoo 360, stated in a 2019 annual report filed with the Shanghai Stock Exchange that it acquired Lemon Seed and two other companies for “US$69.4 million and an intangible asset.” The other companies were Lemon Clove Pte. Ltd. and Autumn Breeze Pte. Ltd.

This shows Qihoo 360 acquired the owner of Innovative Connecting, the developer of VPN apps in the Apple App Store. The U.S. Commerce Department sanctioned Qihoo 360 on national security grounds in June 2020, citing the “significant risk” that it takes part in the “procurement of commodities and technologies for military end-use in China.”

The company was put on the Commerce Department’s Entity List, which restricts its ability to receive U.S. exports without a license due to national security concerns. According to a 2015 article in the state-run China Daily, Qihoo 360’s customers have included China’s People’s Liberation Army and at least eight Chinese government ministries. It has been designated by the U.S. Department of Defense as a “Chinese military company” operating in the U.S.

Innovative Connecting—the app company that came under the control of Qihoo—is behind multiple VPNs through a network of interlocking companies, according to a previous report by industry research firm VPNpro.

Its companies developed two other VPNs in the top 100 free downloaded list last year—VPN Proxy Master (ranked 12th) and Thunder VPN (ranked 60th), as well as an unranked app, Snap VPN.